Government agencies and businesses in Kenya could face severe data breaches following the discovery of two critical flaws in PHP, a programming language used to run about 70 per cent of websites and online services.
According to research released on Tuesday, October 20, the vulnerabilities could allow hackers to gain unauthorised access to a website's server, where information is stored and processed.
Experts warn that depending on the level of access obtained, attackers could steal data, alter website content or disrupt online services.
When a person visits a website, PHP helps the site process requests, display information, and communicate with databases that store records. For example, reading this article on Kenyans.co.ke and viewing images here.
A file photo of screen displaying website code.
Photo
Canva
Thousands of Kenyan websites rely on PHP, including websites associated with essential public services, education, telecommunications, and business.
The flaws were identified with the help of artificial intelligence models, with research and preparations for the fixes taking place over the past two months.
“Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP,” OpenAI said in a statement on Wednesday, October 21.
The vulnerabilities have triggered precautionary measures in several countries, with government agencies and other organisations temporarily taking some websites offline while preparing to install security updates.
In the Netherlands, government websites were taken offline as a precaution, while Finland and France also temporarily shut down some public-facing government websites.
The United Kingdom's National Cyber Security Centre urged organisations to take immediate action, advising them to consider taking affected systems offline if they could not apply the security updates or adequately mitigate the risks in time.
The U.S. National Security Agency (NSA) also warned organisations using PHP to prepare for the updates, saying the vulnerabilities could provide a direct route to a server's file system or database.
“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” the NSA said.
PHP released security updates on Wednesday, urging users to install them immediately.
As website owners assess the risks, technology companies WordPress and Cloudflare have outlined measures to help protect websites against attempts to exploit the vulnerabilities.
WordPress, in a statement seen by Kenyans.co.ke, asked users to address the underlying PHP security issue rather than rely on a WordPress update alone.
Cloudflare said it had deployed default web application firewall protections against the newly disclosed vulnerabilities before public disclosure. “The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers,” Cloudflare said.
According to experts, the warning does not mean that all websites using PHP are vulnerable or that Kenyan government agencies and businesses have already been hacked.
A hacker wearing a hoodie operates a computer.
File